Safely sandbox and execute user submitted JavaScript?

You can use sandbox support in nodejs with vm.runInContext(‘js code’, context), sample in api documentation: https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_options const util = require(‘util’); const vm = require(‘vm’); const sandbox = { globalVar: 1 }; vm.createContext(sandbox); for (var i = 0; i < 10; ++i) { vm.runInContext(‘globalVar *= 2;’, sandbox); } console.log(util.inspect(sandbox)); // { globalVar: 1024 } WARN: As … Read more

Doing math in vb.net like Eval in javascript

There’s a shortcut for limited (ie. simple) math expressions by using the DataTable.Compute method. Obviously, this isn’t robust (limited functionality) and feels hackish to misuse the DataTable for this purpose, but I figured I would add to the current answers. Example: var result = new DataTable().Compute(“3+(7/3.5)”, null); // 5 “Sin(90)” wouldn’t work with this approach. … Read more

Are there any way to execute a query inside the string value (like eval) in PostgreSQL?

If the statements you are trying to “eval” always return the same data type, you could write an eval() function that uses the EXECUTE mentioned by Grzegorz. create or replace function eval(expression text) returns integer as $body$ declare result integer; begin execute expression into result; return result; end; $body$ language plpgsql Then you could do … Read more

When is `eval` in Ruby justified?

The only case I know of (other than “I have this string and I want to execute it”) is dynamically dealing with local and global variables. Ruby has methods to get the names of local and global variables, but it lacks methods to get or set their values based on these names. The only way … Read more

Eval is evil… So what should I use instead?

json.org has a nice javascript library simple usage: JSON.parse(‘[{“some”:”json”}]’); JSON.stringify([{some:’json’}]); Edit: As pointed out in comments, this uses eval if you look through its source (although it looks to be sanitized first) to avoid it completely, look at json_parse or json-sans-eval json2.js is insecure, json_parse.js is slow, json-sans-eval.js is non-validating